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Abstract 


H 2 0 water 


A major hazard posed by the propulsion system of 
hypersonic and space vehicles is the possibility of fire or 
explosion in the vehicle environment. The hazard is 
mitigated by minimizing or detecting, in the vehicle 
environment, the three ingredients essential to 
producing fire: fuel, oxidizer, and an ignition source. 
The Linear Aerospike SR-71 Experiment (LASRE) 
consisted of a linear aerospike rocket engine integrated 
into one-half of an X-33-like lifting body shape, carried 
on top of an SR-71 aircraft. Gaseous hydrogen and 
liquid oxygen were used as propellants. Although 
LASRE is a one-of-a-kind experimental system, it must 
be rated for piloted flight, so this test presented a unique 
challenge. To help meet safety requirements, the 
following propulsion hazard mitigation systems were 
incorporated into the experiment: pod inert purge, 
oxygen sensors, a hydrogen leak detection algorithm, 
hydrogen sensors, fire detection and pod temperature 
thermocouples, water misting, and control room 
displays. These systems are described, and their 
development discussed. Analyses, ground test, and flight 
test results are presented, as are findings and lessons 
learned. 

Nomenclature 

canoe aerodynamically -shaped pod, housing 

fluid and other systems in LASRE 

GH 2 gaseous hydrogen 

H 2 hydrogen 
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Introduction 

For hypersonic and space vehicles that are reusable 
or piloted, safety is an exceptionally important 
consideration. For piloted vehicles, this consideration is 
a result of the possible tragic consequences of a mishap. 
For reusable launch vehicles, cost is the major driver; 
the total operational costs must be minimized, including 
the high cost of losing an expensive vehicle and its 
payload as a result of a mishap. For a flight research 
project, safe flight can be considered as important as the 
technology being investigated. 

A major hazard posed by the propulsion system of 
hypersonic and space vehicles is the possibility of a fire 
or explosion in the vehicle environment. These systems 
store a large amount of potential energy in the form of 
fuel, oxidizer, high pressures or a combination of 
these. 1,2 The three ingredients essential to the 
production of fire are fuel, oxidizer, and an ignition 
source (except in the case of hypergolics and 
pyrophorics, which can combust without an ignition 
source). Minimizing or detecting those three ingredients 
in the vehicle environment mitigates the hazard. In 
addition to sound design and operational practices, it is 
often necessary to provide dedicated hazard mitigation 
systems. 

The Linear Aerospike SR-7 1 Experiment (LASRE) is 
a flight experiment of a reusable launch vehicle 


propulsion concept done in cooperation with the 
industry. NASA Dryden Flight Research Center, 
Edwards, California was responsible for the flight test. 3 
The experiment consisted of a linear aerospike rocket 
engine integrated into one-half of an X-33-like lifting 
body shape, carried on top of an SR-71 aircraft (figs. 1, 
2). Unlike conventional bell nozzle rockets, the linear 
aerospike engine can compensate for ambient back- 
pressure effects to provide higher performance over a 
wide range of altitudes. However, external flow 
slipstream effects on the nozzle flow may reduce 
performance. Therefore, the primary objective of 
LASRE was to evaluate flight effects on aerospike 
engine performance at several altitudes and Mach 
numbers. Although LASRE is a one-of-a-kind 
experimental system, it had to be rated for piloted flight, 
which demands a high degree of safety. A rapid 
prototyping approach was taken to hardware 
development. This approach resulted in an extended 
series of tests to troubleshoot and validate the integrated 
system. These tests included various functional tests 
such as ‘cold flows’ of inert fluids, ‘ignition tests’ using 
L0 2 and triethylaluminum-triethylborane (TEA-TEB), 
and actual ‘hot fires’ of the engine. 

A simplified schematic of fluid systems in the LASRE 
pod is shown in figure 3. Essentially, this was a flying 
rocket engine test facility. The model is the top portion 
shaped like half of a lifting body. The canoe is an 
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Figure 3. Simplified schematic of LASRE fluid systems. 


aerodynamically-shaped pod, housing several fluid (and in the engine block and out the water exit line. Two 9000 

other) systems. A 4000 psi gaseous hydrogen ( H 2 ) psi gaseous helium (He) systems provided L0 2 

blowdown system, containing about 20 lb of H 2 , pressurant, water pressurant, line purges, TEA-TEB 

provided fuel to the engine. A liquid oxygen (L0 2 ) cartridge expulsion and pneumatic valve actuation. The 

system, containing about 330 lb of L0 2 , and SR-71 contained water for pod misting, and liquid 

pressurized to about 365 psi, provided the oxidizer. Both nitrogen (LN 2 ) for pod inert purge. 

H 2 and L0 2 could be dumped overboard through the 

engine. H 2 could also be expelled overboard through Even before hazard mitigation systems were 
dump lines, and L0 2 pressure could be released incorporated, the soundness of the underlying 

through a vent line. Triethylaluminum-triethylborane propulsion system itself had to be assured. The system 

(TEA-TEB), a pyrophoric, was used to initiate was intended to be fail-safe for single-point failures, 

combustion in the engine. Engine coolant water, Component burst and proof factors were equal to or 

pressurized to 800 psi, flowed through channels drilled greater than those used in typical missile and space 
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systems. 4 The and L0 2 systems were leak checked 
as much as was feasible on the integrated pod, using 
long-term pressure decay, bubble fluid, an ultrasonic 
leak detector, a thermal conductivity leak detector, an 
electrochemical hydrogen sensor, and blowdown testing. 

Flammability limits for U 2 - 0 2 - N 2 mixtures at sea 
level are about 4 percent H 2 and 4 percent 0 2 , and are 
fairly independent of each other (fig. 4). The limits 
remained about the same throughout the LAS RE flight 
envelope, extending up to an altitude of 50,000 ft, and 
were not significantly narrowed by reduced pressures at 
those altitudes. 5 Calculation of combustion conditions 
at equilibrium or for detonation showed that even for 
low flammable concentrations of H 2 and 0 2 , 
temperatures and pressures high enough for catastrophic 
consequences could develop. Therefore, a ground rule 
was established that 0 2 and H 2 concentrations in the 
pod should be maintained below 4 percent during the 
entire mission, because any combustion in the pod was 
considered unacceptable. 

To help meet safety requirements, propulsion hazard 
mitigation systems were incorporated in LASRE. These 
systems were: a pod inert purge, 0 2 sensors, a H 2 leak 
detection algorithm, H 2 sensors, fire detection and pod 
temperature thermocouples, water misting, and control 
room displays. These systems are described, and their 
development discussed. Analyses, ground test, and flight 


test results are presented, as are findings and lessons 
learned. Use of trade names or names of manufacturers 
in this document does not constitute an official 
endorsement of such products or manufacturers, either 
expressed or implied, by the National Aeronautics and 
Space Administration. 

Propulsion Hazard Mitigation Systems 

The following sections discuss the systems and 
methods used to mitigate propulsion hazards. Findings 
and lessons learned as a result of tests performed are 
also presented. 

Pod Inert Purge 

The pod cavity was purged with inert N 2 gas, for 
several reasons. The primary purpose was to minimize 
the presence of oxidizer in the pod environment to 
below 4 percent 0 2 by displacing air out of the pod. 
The purge may also reduce the presence of fuel by 
displacing any leaked H 2 . The H 2 and L0 2 valves and 
some of the electronics boxes were purged with N 2 , to 
minimize ignition sources. This purge surrounded the 
electronics with inert gas, and prevented moisture 
caused by water misting from coming into contact with 
the electronics. 

Figure 5 shows a schematic of the N 2 purge system. 
N 2 was supplied from two LN 2 Dewar flasks onboard 
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Figure 5. Nitrogen purge system schematic. 
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the SR-71. LN 2 was vaporized by electric heaters, it 
was dispersed into the pod through perforated piccolo 
tubes near the front of the pod, and also into the 
electronics boxes and valves. The two Dewar flasks held 
a total of 100 liters (180 lb) of LN 2 . The flow rate was 
about 2.5 lb/min, or 34 standard cubic feet per minute, 
for an operating duration of 72 minutes. These flow 
rates gave about 0.3 volume change-outs per minute on 
the ground, and 2.4 change-outs per minute at an 
altitude of 50,000 ft. For ground operations, N 2 was 
directly provided from a ground cart to conserve the 
onboard LN 2 supply. During flight, flow could be 
turned on or off from the SR-71 rear cockpit, and the 
operating pressure was monitored in the control room to 
verify flow. 

Purge effectiveness was evaluated primarily by using 
0 2 sensors distributed in the pod. Preliminary ground 
testing revealed that it took a long time to establish a 
purged environment, and the pod panels had to be well- 
sealed to maintain it. Therefore, a separate monster 
purge was implemented to establish an initially purged 
environment by using ground service equipment that fed 
large quantities of N 2 directly into the pod. During 
subsequent ground tests an adequate purge was 
confirmed. In flight however, substantial infiltration of 
external air occurred shortly after takeoff and purge 
effectiveness was quickly lost, with 0 2 levels reaching 
nearly 21 percent. Therefore, attempts were made to 
seal gaps in the pod by using elastic materials such as 
foam rubber and caulking. Also, the second LN 2 Dewar 
flask was added, and purge flow rate was doubled to 
current levels (2.5 lb/min). In addition, a valve was 
placed in the purge vent line, which could be remotely 
actuated from the cockpit. With the valve open, the 
purge gas flowed through the pod and out the vent as 
originally designed, which also allowed any major leaks 
to be vented out of the pod. With the valve closed, the 
purge gas maintained a positive pressure in the pod, thus 
reducing air infiltration. The purge gas flowed out from 
any remaining leak paths. A subsequent flight test 
demonstrated adequate purge performance for flight, up 
to about Mach 0.9 and an altitude of 26,000 ft, with 0 2 
levels below 4 percent. Figure 6 shows Mach number, 
altitude, and the measured 0 2 levels during a portion of 
the flight. The canoe 0 2 sensor that reads consistently 
low 0 2 levels is located close to a purge piccolo tube 
near the front of the canoe. The spike above 4 percent is 
believed to be telemetry noise. A preliminary 
assessment of additional data suggested that purge 
integrity may be maintained up to Mach 1.6 and an 
altitude of 50,000 ft. It was observed that with the vent 
valve closed, pressure was maintained in the pod during 
climb and descent. During climb, ambient pressure 


decreased, and pod pressure was maintained above 
ambient pressure, which aided purge effectiveness. 
However, during descent the opposite effect occurred, 
which made it difficult to maintain an adequate purge. 
These tests demonstrated that it is important to provide 
an adequate purge flow rate, and to seal the vehicle well 
against outside air infiltration. 

Oxygen Sensors 

Twelve oxygen sensors were located in the pod to 
detect the presence of oxidizer, eight in the canoe and 
four in the model. The purpose of these sensors was to 
determine inert purge effectiveness, infiltration of 
outside air, and the presence of any leaked L0 2 . 
Commercially available electrolytic sensors were used, 
originally intended for automotive applications. Each 
sensor was installed in a temperature-controlled canister 
which was heated to about 1 15 °F, to reduce effects of 
ambient temperature changes on the readings. These 
sensors were point measurements that would not detect 
air or oxygen which could have been trapped in other 
areas, but the number and distribution of the sensors 
were judged sufficient to characterize overall 0 2 levels 
in the pod. 

It was evident from data at altitude that these sensors 
actually measured the partial pressure of 0 2 , but 
volume fraction is of greater interest than partial 
pressure for determining the flammability of mixtures. 
Therefore, volume fraction of 0 2 ( %0 2 ) was 

calculated by correcting the measured partial pressure 
of 0 9 (%0 9 ) to sea level pressure (P 5L ), using 

ambient pressure (P am b )* as follows: 


% 0 9 = % 0 2 

L ^ meas 



(i) 


Accuracy of the sensor at sea level, according to the 
specification sheet, was 1 percent. But for a given 
volume fraction of 0 2 , as altitude increased, ambient 
pressure decreased, and the partial pressure of 0 2 
decreased, approaching sensor accuracy limits. As a 
result, at high altitudes 0 2 volume fraction determined 
from sensor readings appeared erratic. 


A test program was undertaken to better characterize 
sensor accuracy at altitude. In a small test chamber, 
sensors were exposed to a range of 0 2 concentrations 
varying from 0 percent to 21 percent, at a range of 
pressure altitudes from sea level to 80,000 ft. Because 
sensors have a life of about 2 years, new sensors as well 
as older ones were tested to help determine aging 
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Figure 6. Nitrogen purge effectiveness in flight, from takeoff up to Mach 0.9 and an altitude of 26,000 ft. 
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effects. Representative results for 0 percent, 1 percent, 
2 percent and 5 percent 0 2 concentrations are shown in 
figure 7(a). Accuracy at sea level appears much better 
than the specified 1 percent accuracy, but a distinct 
drop-off is seen above an altitude of 30,000 ft. To 
compensate for the drop-off, a fifth-order polynomial 
correction was applied to the average of the sensor 
readings (fig. 7(b)). Ninety-nine percent confidence 
intervals for the corrected readings, based on the 
t-distribution, were less than 1.3 percent up to an 
altitude of 50,000 ft (fig. 7(c)). 

Rules were established for interpreting and acting on 
0 2 sensor data during flight. If any 0 2 sensor, plus its 
uncertainty, exceeded a specified threshold level 
(nominally 4 percent), steps would be taken to secure 
the system and mitigate the hazard, typically by 
dumping the H 2 overboard. 


Hydrogen Pressure Decay Leak Detection 

In order to infer the presence of fuel in the pod, a 
real-time pressure-decay method was used to detect 
leaking hydrogen. Conventionally, pressure-decay leak 
detection takes a long time to perform, and is done 
during system checkout. A noticeable pressure drop in 
the gaseous hydrogen tanks during flight operation 
would indicate a large leak, or perhaps a thermal 
transient. However, as a result of the unavailability of 
hydrogen sensors, a pressure-decay method was 
implemented for real time in-flight use. It was for 
detection of leaks from the H 2 tanks in a static mode 
only, and not for detection of leaks in the H 2 lines or 
during flow. 

In theory, the hydrogen tank leak rate can be 
determined from the change in mass of hydrogen in the 
tanks (A m H ) as follows: 


Clearly, it was important to validate 0 2 sensor 
accuracy before use, especially because these sensors 
were being used outside their originally intended 
environment. Characteristics of other types of sensors, 
or sensors from other manufacturers, might be entirely 
different. 


A m u 2 


wp_ _ M 

R\ZT ZqTq) 


( 2 ) 


Tank pressure (P) was measured by a pressure 
transducer. Hydrogen gas temperature (7) was measured 
by two redundant thermocouples mounted on probes 



(a) Pressure altitude compared with percent 0 2 , for 5 percent, 2 percent, 1 percent and 0 percent 0 2 mixtures. 

Figure 7. Oxygen sensor altitude chamber test data. 
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(b) Pressure altitude compared with percent 0 2 with fifth order correction, for 5 percent, 2 percent, 1 percent and 
0 percent 0 2 mixtures. 


% O2 

uncertainty 



(c) Pressure altitude compared with 99 percent confidence intervals for 5 percent, 2 percent and 1 percent O 0 mixtures. 

Figure 7. Concluded. 
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inside the tanks, which were averaged together. Note, 
that to obtain an accurate measurement of gas 
temperature under changing conditions, a tank surface 
measurement would have been inadequate. Tank volume 
(V) was assumed to be constant. Compressibility (Z) 
was a function of P and T, and the subscript 0 denotes 
initial conditions. R is the gas constant for H 2 . 

In software, digital low-pass filtering was applied to 
the A m H signal, to remove high frequency random 
noise, and to facilitate data interpretation. The filter time 
constant was adjustable, and was set by the user to obtain 
a readable signal, while preserving reasonable response 
time and quick recovery from data spikes. Magnitude 
limits were imposed to prevent telemetry data spikes 
from corrupting the calculation. The calculation could be 
configured for either hydrogen or inert helium as the 
working gas. The resulting A m H ^ signal was displayed 
on a scrolling time history display (fig. 8). 

The ability to detect leaks depended on discerning 
small changes in pressure and temperature, which was a 
function of instrumentation accuracy. The trace showed 
good stability under the varying ambient conditions of 
flight. Uncertainty analysis indicated that a mass loss of 
0.15 lb or more could be detected. Ground testing, done 
by releasing controlled small amounts of gas from the 
tanks and observing the trace, showed that mass loss as 
low as 0.03 lb could be detected. 

In the control room, if a mass loss rate of greater than 
0.03 lb was seen in 8 minutes or less, it would be 
considered a positive determination of leakage, and 
steps would be initiated to secure the system by 
dumping propellants overboard. This leak rate 
corresponds to about 4 percent of the N 2 purge flow rate 
in the vicinity of the H 2 tanks, or about 1460 standard 
cubic inches per minute. This amount was judged to be 


the minimum leak rate reliably detectable in a 
reasonable timeframe. However, this is still a substantial 
and potentially hazardous quantity of hydrogen that is 
capable of locally forming combustible mixtures in the 
pod. Lower leak rates could possibly be detected over a 
longer period of time. 

The H 2 leak detection algorithm was a useful tool 
and was the only available means of H 2 leak detection 
on LASRE, but could not be relied upon to detect all 
hazardous leaks. This algorithm could detect moderate 
to large tank leaks, or smaller leaks over a long period of 
time. However, it could not detect small but still 
hazardous leaks in a timely manner, nor did it detect 
leaks in the H 2 lines. 

Hydrogen Sensors 

Although H 2 sensors were not used, they would have 
constituted a more direct way to detect the presence of 
fuel. Sensors were planned to be strategically positioned 
within the canoe and model. The sensor proposed for 
use was based upon a design developed by Sandia 
National Laboratories, Albuquerque, New Mexico. 6 The 
sensor element was a Palladium-Nickel patch that has a 
current passing through it. When present, hydrogen 
freely infiltrates the lattice network of the crystal, 
causing a change to the electrical resistance of the 
element proportional to the local concentration. The 
element was temperature regulated by a controller, 
which aided in the response time of the sensor and 
removed one of the operational variables. The 
advertised range of detection was 1 percent to 
100 percent volume fraction, with 0.5 percent accuracy. 

The suitability and accuracy of the sensor in a flight 
environment needed to be ascertained. A test chamber 
was used to simulate pressure altitudes. Testing was 
conducted with pure N 2 and with calibration gases of 
specific concentrations of H 2 in N 2 , at discrete ambient 
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Figure 8. Hydrogen tank leak detection algorithm scrolling time history plot display. 
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pressure points ranging from 2 psia to 13.5 psia. The 
sensor heating element mitigated temperature effects. 

Preliminary data for seven sensors with a 3 percent 
H 2 concentration by volume are shown in figure 9(a). It 
is clear from the data that when the ambient pressure 
was reduced the sensor measured concentration was 
also lowered and a linear relationship existed between 
ambient pressures and the measured concentration. 
Therefore, the H 2 sensors appear to measure partial 
pressure of the gas to be detected, much like the 0 2 
sensors. If this phenomenon was not accounted for, and 
the sensor readings (%H 7 ) were used without 

correction during flight, the readings could potentially 
lead to the false conclusion that the flammability limits 
had not yet been reached. Like the O 0 sensors, the 
following correction algorithm could be applied real- 
time during flight using ambient pressure measurements 
(P amb ) the pod and the pressure at which the sensors 

were calibrated (P ca m,), to obtain percent volume of 
hydrogen (%H 2 ) present. 

p 

%H 1 = %H 2 (3) 

L ^ meas r u 

amb 


Results of applying this simple correction to the raw 
data are shown in figure 9(b). Stable readings were seen 
up to nearly 27,000 ft pressure altitude. Deviation from 
3 percent actual concentration indicates a bias error, but 
it was believed this could be corrected with a more 
rigorous calibration program. Above an altitude of 
27,000 ft, the accuracy limitation of the sensor is 
reflected in the nonlinear deviation and data scatter. Very 
similar results where achieved using a 10 percent H 0 
concentration. 

Unfortunately, once installed in the pod, the system 
could not be made to function correctly, apparently 
because of design flaws in the H 2 sensor controller. 
Programmatic and schedule constraints ruled out the 
possibility of troubleshooting to correct the system, so 
the H 2 sensors were not installed for flight. 

Certainly, a H 2 detection system would be highly 
desirable for hazard mitigation. Bench test results were 
promising for future flight applications. However, H 2 
sensors and systems that are qualified for use in inert 
background, with varying pressures and temperatures 
and that are robust and compact enough for flight 

ao 

application are difficult to find. ’ H 0 detection 
technologies can be pursued for future projects, as this 
type of fuel becomes more prevalent. 



(a) Pressure altitude compared with percent H 2 measured, for 3 percent H 2 mixture. 
Figure 9. Hydrogen sensor altitude chamber test data. 
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(b) Pressure altitude compared with percent H 2 , for 3 percent H 2 mixture. 
Figure 9. concluded. 


Fire Detection and Pod Temperature Thermocouples 

Fifteen thermocouples were distributed throughout 
the pod for sensing heat from nearby combustion. 
Thermocouples are commonly used for local fire 
detection. Procedurally, if high temperatures that were 
far above expected ambient total temperatures were 
seen (especially locally), fire would be indicated and 
steps would be taken to dump the propellants and secure 
the aircraft. 

The thermocouples were also used to monitor pod 
environment temperatures, because certain components 
were temperature limited, such as the composite H 2 
tanks and electronics. Flight data (fig. 10) showed that, 
except for some areas near cryogenic components, the 
pod thermal environment was quite benign throughout 
the mission profile. During ground operations and in 
flight up to Mach 1.6 and an altitude of 50,000 ft, 
temperatures typically ranged from 45 °F to 85 °F. This 
benign environment was unexpected, given the wide 
range of external static and total temperatures 
throughout the mission. If pod temperatures had 
approached the H 2 tank temperature limit of 130 °F, 
steps would have been taken to cool the pod by 
decelerating the aircraft or turning on the water mist. If 
these measures had not been successful, the H 2 tanks 


would have been depressurized by dumping the contents 
overboard. 

Water Misting and Coolant System 

The coolant water system was used to provide a 
cooling water mist for the pod, and to recirculate 
coolant for the electronics. The recirculating coolant 
was required anytime the pod was powered up. The mist 
was to be turned on only when necessary and 
appropriate for pod cooling, such as during high 
stagnation temperature flight conditions 

Figure 11 shows a schematic of the system. About 
20 gallons of water was carried aboard the SR-71. The 
recirculating coolant flow rate was 3 gallons per minute 
(gpm), and the mist flow rate was 0.18 gpm. The water 
was chilled by cold air from the SR-71 environmental 
control system. It was important to verify that the N 2 
purge was on before turning on the water mist, to 
prevent moisture from entering the electronics boxes. 
Figure 12 shows the altitude and temperature regimes 
where the water mist boils into vapor; condensing water 
was undesirable, because it could cause hardware 
problems. The upper temperature limit for the 
composite high-pressure tanks is also indicated. Clearly, 
the usable range for water mist is limited if 
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Figure 10. Pod in-flight thermal environment, up to Mach 1.6 and an altitude 50,000 ft. 
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Figure 1 1. Pod water-misting and coolant system schematic. 
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condensation is to be avoided. Also, water mist was not 
for use as a fire suppressant, and could aggravate 
electrical fires. 

The original dual coolant pumps experienced repeated 
failures, because they were not designed for continuous 
service. These pumps were replaced with a more robust 
single pump. In practice, the water mist system was 
never used in flight because additional cooling was not 
necessary and because there were concerns about 
hardware damage from water condensation. 

Control Room Displays 

Propulsion systems and fire hazard mitigation system 
parameters were monitored in real time using control 
room displays. Two displays (not shown) were 
dedicated to monitoring propulsion system parameters 
and general system health. These displays schematically 


represented the propellant feed systems, and were used 
for decision making during tests and missions. 
Additional displays and strip charts showed more 
detailed and time history data of specific parts of the 
propulsion and fire hazard mitigation systems. 

One display was primarily used for monitoring of the 
fire hazard mitigation systems and parameters (fig. 13). 
This display included: a time history plot of the H 2 leak 
detection algorithm; bar charts and digital values of the 
fire detection thermocouples and 0 2 sensors; and digital 
indicators of LN 0 purge and water misting and coolant 
systems. The operator of this display could easily switch 
to time histories of the fire detection, thermocouples, 
0 2 sensors, or H 2 sensors by selecting the appropriate 
on-screen button. A keyboard interface allowed 
real-time setup and resets of the leak detection 
algorithm. All critical parameters changed from green, 
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Figure 13. Primary control room display for fire hazard mitigation systems. 
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to yellow, then red, as they approached and then 
exceeded predetermined limits. 

Ground tests and inert flight tests helped validate and 
mature the control room displays and operating 
procedures. Control room displays, although they may 
appear overly detailed, proved indispensable during the 
extended development and troubleshooting program, 
and for determining system status and performance. 

Conclusions 

The LASRE experiment incorporated a number of 
propulsion hazard mitigation systems. Hazards were 
mitigated by minimizing or detecting the three 
ingredients essential to the production of fire: fuel, 
oxidizer, and ignition source. The major findings were 
as follows. 

For inert purge of the vehicle cavity, it was important 
to provide an adequate purge flow rate and to seal the 
vehicle well against outside air infiltration. Those efforts 
reduced the in-flight cavity 0 2 levels from nearly 
2 1 percent to below 4 percent. 

Oxygen and hydrogen sensor accuracies in flight 
needed to be considered. Accuracy in terms of volume 
fraction-of-gas degraded at high altitudes. This was 
because the sensors actually measured partial pressure 
of the gas. For a given volume fraction-of-gas, as 
altitude increased, ambient pressure decreased, and the 
partial pressure of the gas also decreased, approaching 
sensor accuracy limits. Sensor accuracy could be better 
characterized by calibration at reduced pressures. 
Oxygen sensors were a mature technology and were 
value-added for safety monitoring. Accurate and robust 
hydrogen sensors able to operate in an inert flight 
environment were identified as an important safety 
technology, requiring further development. 

A pressure- and temperature-based gaseous propellant 
tank leak-detection algorithm was found to be a useful 
tool, but could not be relied upon to detect all hazardous 
leaks. This algorithm could detect moderate to large 
tank leaks, or smaller leaks over a long period of time. 
However it could not detect small, but still hazardous, 
leaks in a timely manner, nor did it detect leaks in the 
H 2 lines or during flow. 

The pod thermal environment was found to be 
surprisingly benign throughout the mission, up to 


Mach 1.6 and an altitude of 50,000 ft, given the wide 
range of static and total temperatures. The water mist 
system was never used in flight, because additional 
cooling was not necessary, and because of concerns 
about hardware damage from water condensation. 

Detailed control room displays proved indispensable 
during the extended development and troubleshooting 
program, and for determining system status and 
performance. 
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